Need help with a Splunkd log message

[SN1]

this message is displaying in the splunkd logs on syslog server.
we are forwarding data from syslog server to DMZ server as we are getting logs from outside our network. And then to indexer.

[sb_garimella]

Hey Hi,

I did encounter this issue a couple of times and it happened to be a connectivity issue where the Comms between source and destination wasn't enabled and firewall was blocking it. If this is the route taken: Syslog server -> DMZ server -> Indexers, then checking the following may help.

1. Please validate the connectivity between Syslog server and DMZ and ensure appropriate ports are open to receive the data on DMZ server. Please check if firewall is blocking it
2. Please verify the outputs.conf on the syslog server
3. Please validate the connectivity between DMZ server and Indexers .Please check if firewall is blocking it

[livehybrid]

Hi @SN1 

Are you able to confirm if the input queue was blocked on the receiving server (e.g. another HF or your indexer)? The log suggests that for a small period of time it could not connect to the indexer/HF.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing